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IN THE FEDERAL DISTRICT COURT 

IN THE DISTRICT OF COLUMBIA 
j^ 

LEE PAIGE, 



Plaintiff, 



V 



CASE NO: 
1:06CV 00644-EGS 



DO J and DEA, 



Defendant. : 
^ 



Washington, D.C 
Thursday, January 17, 2008 



Deposition of 



TOM GREGG 



called for oral examination by counsel for 
Plaintiff^ pursuant to Notice, at the US DOJ Civil 
Division, Federal Programs, 200 Massachusetts 
Avenue, Northwest, Washington, D.C, before Mary 
E. Warner of Capital Reporting, sworn by a Notary 
Public in and for the District of Columbia, 
beginning at 8:50 a.m. 
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PROCEEDINGS 
WHEREUPON, 

TOM GREGG 
called as a witness, and having been first duly 
sworn, was examined and testified as follows: 

EXAMINATION BY COUNSEL FOR PLAINTIF 



7 BY MR, MEYTHALER: 



Q 
A 

Q 
A 

Q 

area? 



Would you state your name, please? 

Thomas Gregg, 

How old are you, Mr. Gregg? 

48 years old. 

And you reside in the Washington^ D.C 



A Yes. 

Q Married? 

A Yes. 

Q And who are you presently employed with? 

A US Drug Enforcement Administration. 

Q Could you give us a brief thumbnail 
sketch of your background at the DEA, including 
when you started, the offices you worked at and 
the positions you've held? 
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Q A]] righl* So >'ou're not part of the 
Office of Inspections at all, you're with the 
departmenl you've already described? 

A No, actually, if you understand, the 
Ofljce of Inspection has different branches, OPR, 
Security Programs, ] fall under Security 
Programs. So we are a part of the — and then the 
IG has OPR, Inspections and Security Programs* 

So you're under the IG jusl as OPR and 
th e Offi ce of Inspectionsis? ™ 

A Correct* All under the same umbrella, 

Q Okay. Does the Security Programs become 
involved in enforcement- type cases or is it 
n^ainly - 

A No. We do infonn alien security. 

Relating to DEA security? 

A Correct. 

Q And what have you done as pari of the 
investigation? 

A I've examined the e-mail files associated 
to various people. IVe done some research on the 
Intemel as to dales and times the video appeared. 
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you went on the trip? 

MR.PHIPPS: Objection, vague. 
THE WITNESS: ] went there with all ray 
equipment knowing that 1 could look at the stuff, 
and, if need be, I had the equipment necessary to 
doit, 
BY MR, MEYTHALER: 

Q Did you go to other offices and do the 
same sort of thing? 
— A -] just-wenl-lo one building. 

Q Vm sorry. I apologize. Did you go to 
any other district offices around the country 
where you did that? 

A No, 

Q So Florida is ihe only one where you 
weni? 

A Right. 

And why is il you picked Florida and none 
of the others? 

A That*s just where 1 was lold to go. 

And who was giving you directions, 
Mr. Reinke? 
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I traveled down to Florida, looked at some 
computers down in Florida, That's basically it, 

Now, do you recall when you went to 
Florida? 

A Yeah. It was approximately — it was in 
June of '06 to July of '06, 

And one of the things you did there was 
lo examine computers? 

A Uh-huh, yes. 

Q And you made mirror images of two 
computers, correcl? 

A Correct. 

Q Before you went down there, had you made 
the decision to make mirror images of computers? 

A Well, what the goal was lo — to go 
ihrough and look at the computers. Andif any 

■k 

computer had what appeared lo be relevant data, 
yeah, ] would go ahead and make the image of the 
computer, as opposed to silling there and trying 
to analyze it in Florida, and then bring the image 
back to Virginia to analyze it here. 

1 see. And you planned to do that before 
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A Yes. 



Did you come lo learn — do you know who 
JVlr. Derek NIallz is? 

A Huh-uh. 

Dit3 you come to learn that there was a 
DEA agent who had downloaded the accidental 
discharge to his laptop computer? 

A Huh-uh, no. 

Now, did you ever hear of a man named 
Joseph Brunson? 

A No. 

Did you ever hear that the videographer 
has asserted that he saw his version of the 
accidental shooting, his tape of the accidental 
shooting on the Internet within weeks of the 
accidental discharge? 

A Who is that? 

The videographer, 

A No. 

So no one's ever told you that before, 

A Huh-uh. 

You have to say yes or no. 
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time frame, ] thiiik the hits were in '06, 1 
believe, 

Q Well, when you did yoiir review - ] mean, 
did you do anything difTerent than what you had 
done in Orlando? 

A Yes, in Orlando, ] ran the key words and 
if the key word hits, 3 stop. 1 had a lot of 
computers to do, 1 didn't really analyze what it 
bit on or if it hit, and that was going lo be a 

plus J and we^d take-it- On ce^l-got"back here! 

could really in more depth determine when, where 
and how. So that's why I did it here, 

Q On one of Qiese you found the things you 
just mentioned. Did you find any on the other 
one? 

A 1 can't recall which one was which, 
Was there one where you found nothing? 
A 1 think each one had sort of similar — 
it was just — the e-mail account, and ii was 
either a PowerPoint or a PDF, I forget what it 
was, that was on the same exhibit ~ thai was on 
Ihe same one. That was about it. 
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Q Well, then, if the e-mail account and the 
PowerPoint presentation were on the same mirror 
image, does that mean there was nothing of 
significance on the other minror image? 

A Well, now, each one had some general 
reference to Internet history. The biggest 
problem was the - 1 looked at the computers in 
'06, And we were trying to go back and look at 
something that occurred potentially one year or 
two years prior. So the history files just were 
corrupt or, in some cases, not existent, so the 
data was very fragmented, it was just really hard. 
1 wouldn't say that they didn't have a value, they 
had a value, but did they help further what ] was 
trying to do? Mo. 

Now, Mr. Paige's e-mail account, was 
there anything significant there with respect to 
the videotape? 

A No, 

Q And the PowerPoint presentation, 1 didn't 
understand what that consisted of. 

A I'm trying to think what it was. ] just 
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remember it was possibly a birthday card. It was 
something to doing with Father of the Year, I 
remember seeing it because 1 was going through 
searching it. 1 don't know if possibly one of 
your kids made it for you, or somebody e-mailed it 
lo you. But it was just, you know, a very 
innocent — you know, no big deal, 

Did you find any videos on either of the 
mirror images concerning the accidental discharge? 

-A -no:- - ' " 

Was there anything on any of these mirror 
images that assisted you in determining how the 
video was disclosed to someone outside the DEA? 

A No. 

Q All right. Is there anything else 1 
should ask you about the mirror images? 

A 1 know it's kind of confusing, you 
wonder, but no. They really didn't help, you 
know, advance anything. 

Well, Mr. Reinke said that - and 1 hope 
1 get this right - that you found, quote, 
connectivity, end quote. 
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And 1 asked him, "Well, what's thai?'^ 
And he touched his finger lo Ihe table 

and he said "Well, thal's Connectivity." 
I'm sure he's correct, but what is 

connectivity? 

A I think what he's referring to is through 
ihe Inlemel history. And when you look at 
Internet history, it appeared lo be — there was 
activity on the btemet, like 1 said, putfile.com 
and different sites. But where 1 could determine 
Ihe dale and time stamps, time frames, it was 
outside. It was, you know again, '06 time frame. 
Some of the other historical data going back to 
polenlially '04 and '05, 1 couldn't really 
determine what it was or even if it existed. So 
Ihe data was so fragmented. It would be like 
taking your notepad right there and, you know, me 
scratching out some of your notes with a permanent 
marker. Now it's all fragmented, 1 really can't 
read it. So can 1 say ii happened in '04, '05? 
No, 1 really don'l know when it happened. So 1 
saw ihere was aclivity on ihe Internet, but ] 
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couldn't realJy figure out whal it was. 

Q Al] right So you saw — when you say 
"activity on the Jntemetj" you mean someone was 
accessing the Internet? 

A Yeah. It was used as throughout the 
Internet. Like I said, 1 found an Internet-based 
e-mail account for IVIn Paige, so clearly that 
computer had been used to access the Internet to 
do some sort of Internet e-raailing. 

-Q -But-there-wasnoihing that you found- that 
suggested anyone was connected to the Internet 
that had anything to do with the disclosure of the 
video? 

A No. I didn't find anything like that. 

Q A)] right. And how about did you find 
any connectivity with any websites that you 
thought were suspicious? 

A Mo. 

Mow, did you find anything with respect 
10 the video in the later years hke '06 or — if 
it was in '07, if it was '07. 

A The pulfile.com ] found. The reference 
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lo putfile.com was referenced to another video 
that had nothing to do with this. I really don't 
recall what it was, but it had nothing to with 
this incident whatsoever. The only common 
denominator was putfilexom. 

Like I said early ori/the key word ] used 
was "putfile.com." When I did a further 
investigation of the computer, I realized it 
really had no value at that point. 

And you didn't look at any other 
computers in any other offices other than Orlando? 

A Correct, correct. Just that day. 

Mow, during any of your investigation 
have you seen any e-mails being sent on the 
Firebird system that had the video as an 
attachment? 

A What video are you referring to? 

In general when 1 say "video," it's the 
video or a part of the video involving the 
accidental discharge, 

A You're not talking about the original 
footage, I guess. 
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Q Yeah, a copy of it. 
A Mo, I haven't seen that. Tve seen 
e-mails that have clips. 
Yes. 
A Yes, I've seen that. 

Q And how did it come about that you saw 
those? 

A Just from looking at the different 
e-mails and doing my examination of individuals' 
Intemet-historiesr 

All right. Mow, how did you get the 
e-mails? 

A Well, the video I found really came from 
working on a completely unrelated case. I was 
working a case, searching their video files and 
documents, and ] came across a copy of the — of a 
video that had the accidental discharge. And then 
1 determined how that person received it. And 
they received it through an e-mail. Then 1 
tracked it back lo that person that sent the 
e-mail. 

Is diere only one instance where you were 
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able lo track an e-mail that way or are there 
other e-mails as well? 

A 1 tracked two back that way, 
What rm wondering, Mr. Gregg, the 
e-mails that you tracked, how did it come about, 
other than the one you described that was 
serendipity, how did it come about that you knew 
about the e-mails? Was it a result of some 
computer analysis or did Mr. Reinke tclt you or - 
MR. PHIPPS: Objection, misleading, 
THE WITNESS: Mo. I guess 1 need to go 
back a little bit. Part of this early on when 1 
did the research on the Internet and tried to 
determine the origin of the: video and when the 
video first appeared, by doing that, I was able to 
find the video;. but, more importantly, find the 
names that were associated to the video, what 
people were calling the video. 

So once 1 had the name of the video file, 
what I believed what people were calling it, 1 
look that name, and as I would go through and 
search somebody's e-mail account, ] would look for 
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Ihal video file name. 

As an example, if the video was called, 
you know, "Joe" and you name it "Bob," then I'm 
not going to see it. So 1 would look far the 
videos called "Joe." 

So in this case that's what ] did. As 1 
was given names of different people to look at 
their e-mails, 1 would go through their e-mail, 
look for that specific file name. As 1 came 
across it- or-didn-l-Gome-aGrDssitj-as-lhe ease 
may be, that's how 1 ~ and then 1 didn't find 
anything, 1 was working on another case, again, 
completely unrelated, and that file name, as 1 was 
searching through their videos, just popped up and 
1 saw it. And 1 recognized, wait a minute, this 
is one thai ] worked on another case. 
BYMR.MEYTHALER: 

Q AVhal are the types of file names that you 
would " 

A For the video? 
Yes. 

A MOS-MD-DEMO, was one of the file names. 
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That was really the major file name that I looked 
for. 

Q Now, this file name, is this a file name 
that was used by people using the Firebird, or was 

4 

it something on the Internet? 

A Whoever created that video, that's the 
file name that they named it. ]t's no different 
than when you create a document, you give it a 
file name. Whoever created that version gave it 
that file name. And that's what ] saw being 
e-mailed around, 

Q Where did you see it being e-mailed 
around? 

A Well, that's the e-mail that 3 found 
through Kimberly Chase had e-mailed. That's 
originally when 1 first saw it. 

_ h 

Q Was this on a DEA Firebird system? 

A ]t would be internal to our system, 
correct. It would be internal to DEA Firebird, 

Now, how was it that, other than 
Ms. Chase — is she a DEA agent by the way? 

A ] believe so. 
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Q And what office was she in? 
A 1 don'l recall where she was, 
How were you able to look at people's 
e-mails? 

A What do you mean, how — 

Q Well, you said you were checlting e-mail 
accounts or e-mail files. 

A Right, 

1 mean, how can you do that? 

A How canl do that?- 

1 mean, can you sit at your office and do 
that, or do you have to go out and look at 
someone's computer? 

A Mo. Your e-mail is stored — within the 
Firebird network, 1 mean, with any system, it 
depends on your system, your e-mail is stored on 
what's called an exchange server. And that's 
where your e-mail resides. As e-mail sits on your 
exchange server, if I'm asked to look into 
Mr. Paige's e-mail or whomever's e-mail, then they 
have 10 extract that data from the exchange server 
and they give that data to me at that point and 1 
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examine that data. 

So this is not like I'm sitting here live 
watching you send an e-mail back and forth, no. 
I'm taking the data after it's been extracted from 
our Firebird network and then 1 examine that, 

All right. So one thing you did was to 
examine the CPUs that you made mirror images of 
from Orlando? 

A Correct, 

But in addition to that, you also 
examined e-mails that were extracted from this 
exchange server? 

A Correct. 

And whose e-mail was it that you 
examined? 

A 1 don't recall the whole list. Off the 
top of my head, Kimberly Chase, obviously, was one 
of them, Mr. Paige's e-mails. I really don't 
recal! the whole list of people. 

How many people did you examine? 

A To give you a fair — 1 would say it's 
definitely more than 15. 1 really don't know how 



(866) 448 - DEPO 
www.CapitalReportiTigCompaiiy.com 



©2008 



:i7nf'7H7^*fQnjl_Jl/-rH_Q-^^C -4ntil ^crn-»-^^f^ 



Case 1 :06-cv-00644-EGS Document 51 -1 9 Filed 06/20/2008 

Capital Reporting Company 



Page 7 of 13 



1 

2 

3 
4 

5 
6 
7 
B 
9 
JO 
11 
12 
13 
14 
15 
IG 
17 
IB 
19 
20 
21 
22 



1 
2 

3 
4 
5 
6 
7 

a 

9 
10 

11 

12 
13 
14 
15 
16 
17 
10 
19 
20 
21 
22 



12 (Pages 42 to 45) 



Page 42 

many people, 

Q Now, have you prepared any sort of report 
on all of this? 

A ] had prepared two reports back in August 
of *06, ] think it was, the iirat one. 

Q And these were the results of — 

A AVell, the first report^ the DEA 6, was as 
a result of the trip to Orlando, and 1 really 
forget what e:thibits that report included* 

And then lhG-seGond-reportrth6"DEA-6r 

was several months later. And ] think that 
included three additional exhibits. Again, 1 
don't recall exactly what exhibits they were. And 
that's the only two reports that 1 generated. 

AVell, what sorts of exhibits are we 
talking about here? 

A They were the N-1 and N-2, 

Q Okay. 

A Then the e-mail data. I think there were 
some various CDs ] was asked to look at. That was 
about it. 

>low, on the -- when you examined 
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Mr. Paige's e-mails, did you find any references 
to the video or a clip of the video of the 
accidental discharge? 

A Mo. 
MK. PHIPPS: Objection, vague. 
BY MR. MEYTH AlER: 

Did you find anything in Mr. Paige's 
e-mails that would cause you to suspect that 
Mr. Paige himself disclosed the video to anybody? 

A Mo. 

Mow, do you recall if you examined the 
e-mail for Mr. Gruden, Peter Gniden? 

A You know, yeah, I'm pretty sure J did. 
Again, I don't recall the exact list of names, but 
thai name does sound very familiar, so 1 would 
have to think } probably do. 

.0 Who gave you the names. 

A Two ways. A lot of the names would come 
up " Mr. Reinke would give me a list of names, 
but as 1 would do the investigation, and when ] 
started to look at, for instance, Kimberly Chase's 
e-mail, that in itself would spawn off a list of 
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names because as 1 would try to backtrack certain 
things. 

Q Did you check the e-mail for !Mr. Derek 
Maltz? 

A That name doesn't sound famiJiar, so J 
don't know. 

Q Did you check the e-mail for iVIr. Gregory 
AVhite? 

A 1 don't recall that name either, 

— Q—Did-you-check-lhe e-mail for a Mr. Kevin 
Clark? 

A 1 don't recall that name, 

Q Did you check the e-mail for a JVJr. Jeff 
Shafer? 

A 1 checked the e-mail for a Shafer, but 
I'm not sure of the first name. What's the 
speHing of his last name? 

Q S-h-a-f-e-r. 

A Mo. Different Shafer. 

l*ni pretty sure there's just one F. 
Did you check the e-mail for Steve 
Collins? 
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A ] don't recall that name either. 

Q Did you check the e-mail for anyone in 
the Miami office? 

A 1 would have checked quite a few people 
in the Miami office. 1 don't recall the names. A 
lot of the names were given to me. I don^t know 
where they are assigned. If you said some of the 
names I could possibly say yes or no, 

Q Did you check the e-mail for 
Mr. Maughton, M-a-u-g-h-t-o-n? 

A I don't recall that name either. 

Did you check the e-mail for Mr. Kevin 
Scully, S-c-u-M-y? 

A That name sounds familiar. 

That means you might of, it doesn't mean 
you did it? 

A Yeah, it doesn't mean 1 did it. There's 
rwo problems. This has been awhile ago, so a lot 
of this is going to be names sound familiar. 1 
really don't recall who 1 did or didn'l do on this 
list of names. 

Q Did you check the e-mail for Richard 
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Bearing? 

A That name doesn*t sound familiar. 

Q Do you know who he was? 

A No. 

Q Did you checlt the e-mai] for Mr. Inscore? 

A Again, doesn^l sound familiar. 

Q Now, in checking any of this e-mail, lo 
what extent did you find, if any, reference to or 
allachments including the video of the accidental 
discharge-? — 

A Through the videos, you know, obviously 
with Mr, Paige's videos, 1 found reference lo 
people talking about the video. ] think Mr, Paige 
received a couple e-mails from people advising him 
ihat this video has been showing around. ] found 
talk in general like that about the video clip. 
As far as anything else, that was about it. 

Did any of the e-mails you examined have 
the video attached lo it? 

A Yes, 

And how many such videos — 1 mean, how 
many such instances did that occur during your 
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from your office? 

A Yes. 

Q How is that provided to you? ]s it — 
does somebody send it to you over the computer or 
provide you — 

A What happens is when they pi]]l — when 
this mail is extracted from the exchange server, 
it's saved on a share drive. And at that point 
ihat file is called a PST fjle and then what 1 do 
is ]'go out and take a P'ST fileoif-lhe share 
drive and copy it over to my computer and then 
process that PST Jile using forensic software. 

Who actually does thai for you? 

A 1 do thai, 

Q Oh, you do it? 

A ] puli it off and doit. 

You actually extract the e-mails? 

A No, no, ni, ]'m sorry. The local FIKS, 
whoever that FIRS is in that office or wherever it 
is that handles their exchange server would get 
ihe request, 

HRS? 
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pari of the investigation? 1 

A Well, again, when I Avork — when 1 found 2 

the e-mail for agent Chase, ] really don*t recall 3 

how many people it had gone through, 1 just went 4 

back to her. So that reference to the video clip 5 

was found on her e-mail and one other e-mail. So 6 

J guess I'm looking at il backwards, you're 7 

looking al it forwards. . B 

Let's do it your way, 9 

A ] would say I only found one instance 1 

then. 1 1 

One instance of a chain? 1 2 

A Right. 13 

Q And there may be other instances where 1 4 

you saw the video but it was all part of the same 1 5 

chain? 1 6 

A It appeared to be, yeah. So it's easier 1 7 

to explain it that way than to try to keep going 1 Q 

backwards. 1 9 

I agree. Thai's fine. 20 

Now. in addition to examining the 21 

e-mails -- where do you do that from, by the way, 22 
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A That's through our Firebird, the managing 
of the Firebird network. 

What does FIRS stand for? Is that an 
acronym, FIRS? 

A FIRS. Firebird something. 1 just call 
them FIRS. 

But they would pull the e-mail off the 
exchange server for me and then save it to the PST 
file formal, and then at that point, that's when 1 
extract it. 
BY MR. MEYTHAUER: 

All right. Now, you looked at the 
e-mails. You made the trip to Oriando, You 
examined the mirror images, you prepared two 
reports. Is there anything else you did? 1 guess 
you examined some CDs or DVDs? 

A Correct. 

Anything other than that, is there 
anything else that you did? 

A Just the — that's about it. 

And you did some work on the Inlemel? 
A Correct. 
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1 


Q !NoW;, what CDs or DVDs did you examine? 


1 


A March 7lh. 


2 


A ] guess it was the CDs. I don't, again. 


2 


Q And was that Kimberly Chase? 


3 


recall the exact exhibits. I think somewhere out 

+ 


3 


A No- That was Leon Palmer. 


4 


of Orlando, possibly some were labeled 'Tvliami.'* 


4 


Q And what is the earliest reference you 


5 


Q AV ere these all N exhibits? 


5 


found on the Intemel lo the video? 


6 


A Yes. 


6 


A Sometime that first week, it was in that 


7 


Q They were provided to you by Mr. Keinke? 


7 


first week of March. 1 can't pinpoint down an 


B 


A Yes. 


8 


exact date. 


9 


Q And then you did some work on the 


9 


Q Is that because you can't remember or 


-10 


—Intern et?' —-- ' 


1 - 


never-was-able to? 


11 


A Yes. 


11 


A No. ] was never able lo. Everything 


12 


And what did that consist of? 


12 


that 1 deteujuned, nothing was - the day that ] 


13 


A Basically trying to determine when the 


13 


looked at — ] was confident that it happened the 


1^ 


video first appeared on the Internet. 


14 


first week of March, but 1 couldn't pinpoint it 


15 


Well, let me repluiise it, when a 


15 


down lo a day. A lot of the Internet history 


16 


reference lo the video first appeared on the 


16 


going back, historical records, jusl won't allow 


17 


Inlemet was really my goal. 


17 


jne to point to a specific date. 


18 


And what were the results? 


18 


Q Now, you said that 1 .eon Palmer made a 


19 


A It appeared io be from what 1 determined, 


19 


reference to it on March 7th? 


20 


the hrst week in March of '05 is when the first 


20 


A Coirecl. 


21 


reference to the video containing the discharge 


21 


IsheaDEA agent? 


22 


started to occur. 


22 


A I believe so. 
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1 


l^ow, when you say "reference to it/* does 


1 


Q And can you determine from your 


2 


that mean a copy of the video being on the 


2 


investigation from where Mr. Palmer received the 


3 


Internet? 


3 


video? 


4 


A Correct. Even people talking about il — 


4 


A No. 


b 


prior to March of '05, there was obviously people 


5 


Q Why is- that? Why can't you do that? 


6 


on the Internet talking about the accidental 


6 


A At this point ] haven't been able lo 


7 


discharge, but nobody thai 1 could find was 


7 


figure it ouL ] haven't examined his e-mails at 


G 


scTually referring to any video actually showing 


8 


this point. So 1 don't know how he obtained the 


9 


the accidental discharge. And all of a sudden 


9 


video or anything about it. 


10 


March, that activity started, the people started 


10 


Would that help you delermine where il 


11 


talking about, Hey, people having different links 


11 


originally came from? 


12 


lo the video clip or to versions of the video 


12 


A Again, this is an incident that occurred 


13 


clip. And that occurred back in that first week 


13 


in '05. So that e-mail data realistically is 


1^ 


ill ivlarch. 


14 


going to be marginal. You know, we're talking 


15 


And that was on the internet? 


15 


ilmosl three years later. Is it going lo be here, 


16 


A Yes. 


16 


1 don'tknow; J hat's a hfird question to answer 


17 


Did you find any references to the video 


:i7 


■1 

Q Have you talked to Mr. Keinke about 


IB 


earlier than the earliest reference you found on 


18 


trying to track that back? 


19 


Firebird? 


19 


A 1 sent an e-mail advising thai this 


20 


A Say it one more time. 


20 


person had sent an e-mail containing ihe video 


21 


What's the earliest reference on Firebird 


21 


clip. 


22 


that you found with respect to the video? 


22 


Would the information have been more 
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readily available if this had been looked at back 
in March of 2005? 

A Again, it's hard to say. Computer 
evidence, e-mails, anything is very volatile. So 
tliat's a hard thing to answer. The data that 
could potentially have been available in '05, it's 
really unknown if the person deleted his e-mail, I 
mean, it's hard to say. 

So has anything been lost because it has 
taken so many years to look at it? That's a 
question none of us will ever be able to answer 

Q You say e-mail is volatile, what do you 

mean? 

A As you receive an e-mail, if you delete 
it as soon as you get it and clean up ~ if you're 
one of these people that clean up your e-mail 
every single day and you're anal about keeping 
things clean and deleted, it's not going to be 
there. It wouldn't have been there the next day 
more or less two years ago. So that's what I'm 
saying, it's hard to say what— if there was 
anything lost, and I really don't know the answer 
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to that. 

Q Now, other than trying to locate 
information about the video involving Mr. Paige, 
did you look at the mirror images for any other 
type of information? 

A ,1 was asked to later on, 1 was asked to 
look at them again for additional information. 

Q All right. And what type of information 
were you asked to look for? 

A Any type of pornographic images or 
fantasy football. 

Q Did you find any reference to that? 

A No. 

Q And did you have to use key words to look 
for pornography? 

A That was based more on a search of the 
pictures. So that's what 1 examined were picture 
files, JPEGs, you know, GIFs, image files, 

Q Now, were you able to examine every image 
file in these two? 

A Never say all of them. 1 don't know. 1 
examined what I could see, you know. Based on my 22 
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search, 1 didn't find any files that contained 
pornographic images that 1 saw. 

Q I guess what I'm wondering, and I don't 
want to spend much time on this. 

A That's fine. 

Q I would have thought that if you had the 
images of two computers thereM be a lot of 
potential pictures on there. 

A Oh, there were a lot of pictures. 

Q How can you know what ones to look at? 
You can't look at all of them, can you? 

A Yes. Well, let me rephrase that, 1 don't 
want to say I can look at all. I can — 

Q A vast majority, for example? 

A When I load tlie image files into the 
software that I use, thai software will recognize 
different fonmats, whether it be a JPEG or a GIF, 
you know, different formats of the file, whether 
it be a big picture, small picture. 

So of the files that my software 
recognized, those are the ones tliat I viewed. And 
of the ones that 1 viewed, 1 didn't see any 



Page 57 

pictures that appeared to be pornographic. As far 
as the fantasy football, that was more done on key 
word searching of Internet histoiy, as well as 
looking at image files, like for example, a key 
word would be 'Tantasy football," you know, 
"fantasy." And 1 don't recall finding anything 
like that either. 

Q Do you know which computers these mirror 
images of— wait. My question got convoluted 
there. 

Do you know which computers in Orlando 
you made mirror images of? Is there some way to 
identify saying, this is the computer from this 

location? 

A Mr. Reinke could because he has a list. 
I think he has a list that cross-references N-1 to 
whomever, N-2 to whomever. Vm sure at one point 
I knew. I don't recall off the top of my head. 

Q All right. Let me hand you Exhibit 45. 

A Uh-huh. 

Q Now, this and the next three exhibits 
were provided to us yesterday by Mr. Phipps. 
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1 


A Right. 


1 


know whether he was a DEA agent? 




2 


Q Now, for example, on — what is 


2 


A Anybody between this list, 1 didn't look 




3 


Exhibit 45? 


3 


at. Because it had no value because as 1 went 




4 


A Exhibit 45 is an e-mail that Christopher 


4 


through this, 5 was more concerned Avilh the 




5 


Thojiipson received — well, he sent it to Marcus 


5 


origin, who started it. So I didn't wonry about 




6 


Brown and Kathleen Gilbert. And this is the - 


6 


the people in the middle. And that's what brought 




7 


what this represents was the case 1 was woricing 


7 


ijje back to Kimberly Chase, So 1 was focused on 




8 


involved Marcus Brown. 


S 


Kfjuberly Chase. 




9 


So while 1 was examining Marcus Brown's 


9 


Q Can you tell irom this document that the 




in 


-^e=jjjail^account — e-mail activity,] local ed this 


10- 


- original-message-irom-KimbGrly-Ghase was sent to 




11 


e-mail that said, "Shooting your own leg, 


11 


the people lo whom she sent it over Firebird? 




12 


priceless/' And if you notice on the third page 


12 


A Yeah, this is definitely through 




13 


of this document, it shows the attachment was 


13 


Firebird, 




14 


M OS-MD-D£M O.wmv, and that conlained ihe followin 


llA 


Everyihing on here? 




15 


of interest tome. 


15 


A Well, again, 1 can't tell you — well. 




16 


So what 1 did when 1 saw this, 1 


]6 


actually] can. Yeah, all these e-mail accounts 




17 


baclt tracked who had sent this because if you look 


]7 


here arc Firebird, 




la 


in the subject line, it says "FW," so ihat would 


IB 


What about the -- let's just go to the 




19 


imply that it had been forwarded by many people. 


19 


fi rsl one. 




20 


So I kept backtracking lo figure out who 


20 


A Kimberly? 




21 


sent Ihis e-maiL Remember, 1 said it's confusing 


21 


Yes. Let's go to Kimberly. It says here 




22 


when you asked how many people had iL And as I 


22 


it was sent to, among other people, Michael 






1 
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1 


backtracked it, ] come to page 2 which shows 


1 


Grossman. And then above it there's a — you can 




2 


Kimberly Chase. 


2 

1 


see where Michael Grossman has sent it to other 




3 


And at that point in time that 1 found 


\ 3 


people, correct? 




4 


this 1 don*t recall the exact date that 1 found 


4 


A Correct. 




5 


this, but at that point in time, this was the 


5 


So you can tell from here that the e-mail 




6 


first incidence that 1 found of this video clip 


6 


sent lo Michael Grossman was over Firebird? 




7 


MOS-MD-DEMO appearing on the Firebird network. 


7 


A Yes. 




8 


So Kimberly Chase had sent this out to 


1 8 


Now how about the — she sent e-mail also 




9 


however many people listed here: one, two, three, 


i 9 


to f dwin R. Outlaw? 




10 


four, five people. So J was more concerned with 


iio 


A Correct, 




11 


ICimberly Chase since she was the origin. 


hi 


Can you tell whether that was sent over 




12 


Has anyone talked to Kimberly Chase about 


j]2 


Firebird? 




13 


where she got this? 


]3 


A It would appear that all these names were 




14 


A You'd have to ask Mr. Reinke if he talked 


1 


firebird, and the reason why, if wasn^t Firebird, 




15 


lo her at all. " 


|15 


typically what would happen - ] say 




16 


Q Marcus Brown; is he a DEA agent? 


[l6 


"typica ly" - if it's not Firebird, if she had 




17 


. \ A Yes, J believe so. 


17 


sent something to Edwin Outlaw, let's say, at a 




18 


Q And do you know if Kathleen Gilbert is a 


18 


Yahoo account, it would have spelled out 




19 


DEA agent? 


19 


EdwinOutlaw@yahoo.com, but since it's internal to 




20 


A 1 don't know. 


20 


Firebird, it doesn't need the whole extension of 




21 


Q Now, in between, there's a person named 


21 


the e-mail address because it's all internal. So 




22 


Maranello, or first name Steve, do you happen to 


22 

i 


you 11 just see it lisled by name. 
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1 


accounts, that brought me hack to this original 


1 


sounded familiar. It's the vcjy first name on 


2 


e-mail from Keginald Wflh'ams. But that's outside 


2 


here. 


3 


our Pirehird net. 


3 


Go lo page 1 . Remember 1 asked you lo 


4 


Q What does cop.wmv stand for? 


4 


spell Shafer? That's why 1 recognized the name. 


3 


A Just a i3e name* Somebody must have 


5 


Q ] see. 


6 


called it that. 


6 


A Yeah. This is another case 1 *was working 


1 


Q 1 see then to the left of it, there's — 

1 


7 


on involving John T Murray. Again, 1 found, from 


8 


A Temp file? 


B 


locating this e-mail, what was interesting to me 


9 


Q A leujp file, 1 guess^ as you just caJled 


9 


about the e-mail was the subject line was 


10 


it — 


10 


identical-to the subject line of Kimberly Chase's 




11 


A That's this right here, it's just the 


11 


e-mail. And the attachment had the same Jile 


12 


HTML. 


12 


name. 


13 


Q But there's that's that little symbol 


13 


All right. Now, help me with that. I'm 


14 


nghl before J MP, what is that? 


14 


going to go bacl( to Exhibit 45 here. 


15 


A Oh, Internet bxplorer. 


15 


A Okay. 


16 


Okay. 


16 


1 see. The subject line is the very 


17 


A I'm sorry. Right here? You mean this 


17 


same. 


10 


righl here? 


IB 


A Yes. And then ifyou go lo page 3 of 


19 


Q Yeah. It looked familiar lo me, now 1 


19 


Exhibit 45. 


20 


understand why. 


20 


Okay. 


21 


A Internet Explorer. Yeah, that's all it 


2] 


A And ifyou go to page 3 of hxhibit 47, 


22 


is. But the print, it's kind of hard to lelL 


22 


the file names of ihe atlachmenis were the same. 
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1 


Q Do you know what agency uses the e-mail 


1 


Oh, down here. 


2 


hD.gov? 


2 


A Go up one line, go up, up, up. 1 here. 


3 


A ] think it was — if 1 recall, it was 


3 


seeil? 


4 


Department of Education. But, again, Vm nol 


4 


Q Now, ] can look and see for myself but do 


5 


1 00 percent sure. , 


5 


you know if there's any - 


6 


Wow, right below that it says, "Can you 


6 


A Righl, So then whal 1 did — remember 1 


7 


believe that?" Now, who is that message written 


7 


said the hash? 1 compared the hash of both these 


a 


by? Is that by Mr, Williams? 


8 


files and they were, in fad, identical. 


9 


MR. PHIPPS: Objection, foundation. 


9 


The same file? 


10 


'lEE WITNESS: You know, ] really don't 


10 


A Yes, The file that is in attachment — 


11 


know. Again, the e-mail says it's from Reginald 


11 


or Exhibit 45 is identical lo the file that's 


12 


Williams. And in (he body of the e-mail it says. 


12 


ocated in attachment 47. 


13 


Can you believe that?" So whomever sent this 


13 


So that means that it came from ihis ~ 


14 


e-mail would have typed this. 


14 


A The same origin. 


15 


BY MR. MEY i H ALER: 


15 


Q ] he same e ectronic file, wherever it was 


16 


Q And the person that sent this e-mail 'was 


16 


stored? 


17 


Mr.Wilhams? / 


17 


A Wherever it was stored, yeah. 


18 


A Yeah, based on this name, uh-huh. 


18 


Bui you don't know where it was stored*? 


19 


Next is Exhibit 47. And this is the 


19 


A No. 


20 


e-jjiail chain that you referred to earlier 


20 


All right. Now, do you know if there's 


21 


involving Mr, Pabner? 


21 


anyone in this chain that's related to — was 


22 


A Right. This is why the name Shafer 


22 


there any cross-referencing? 1 don*l want you lo 
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look now. If you didn^l look, fine, 

A Ko, I didn't look* All 1 was concerned 
about was the original one. I went back to the 
first. And in his case, he was the first. That 
lakes you back to Leon Palmer. 

Q And this is the earliest reference you 
had found on the Internet at 4:10 p.ni, on March 7? 
MR, PHPPS: Objection, misleading. 
THE WITNESS: Not the ]ntemei, 
-B V-MK. ME^^THALERv 

Q 1 mean Tirebird* Vm sorry. 

A As of this dale, this is the earliest 
reference. During the time frame in which 1 
looked al Kimberiy Chase's, that was the earliest. 
And now ihis has become the earliest. 

l^ow, can you lell al all whether the 
altachmenl to ihis e-mail originaled through Ihe 
Firebird? 

A 1 don'l know. 

Q ll could have originaled - someone could 
have gollen on Ihe Internet and then sent it 
through the Firebird, is thai correct? 
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1 THE WITNESS: Yes, this one here, 46? 

2 BY MR. MEYTHA1:ER: 

3 Q Yes. 

4 A Yes. 

5 Q And you got that from examining 

6 Mr. Paige's e-mail accounts? 

7 A ] honesUy don't recall if 1 got it fi-om 
B examining his e-mails accounts or from examining 
9 Lallimore's accounts. } don't really recall which 

10- - one-3-gol-it-from. _ . 

11 Do you recall if Mr. Reinke told you that 

12 Mr. Paige's attorney has pointed out that 

1 3 Ms. Lattimore e-mailed Mr. Paige and thafs where 

1 4 you got it? 

15 A ] don'l recall where — which e-mail 

1 6 account 1 got this one from. 
3 7 Q Let me hand you Exhibit 48. 

18 A Uh-huh. 

19 Q Mow, did you obtain these e-mails? 

20 A From Mr. Crawford or Mr. Paige's account? 

21 Ves. 

22 A I don'l recall which one. 1 really don't 



I m fcd Mdt* 



Page 75 

A You mean how did Mr. Palmer receive il? 

Ves. 

A 1 have no clue al this point how he 
received il. 

And has anyone interviewed Mr. Palmer? 

A Again. I'm not privy to that information, 
so 1 don't know. 

Q Mow, Mr. Palmer could have gotten this 
from any number of sources, he could have had a 
CD. he could have had a DVD, he could have gotten 
it off the Internet, he could have gotlen it off 
the Firebird Intemel? 

A 1 agree, yeah. 

All right. So Mr. Palmer's e-mail chain 
and Ms. Chase's e-mail chain jusl came across on 
working on unrelaled cases? 

A Exactly. 

And the chain involving Ms. Latlimore you 
developed during the investigation of this 
particular video, is that correct? 

A This one here? 
MR.PHIPPS: 46. 
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1 recall if] got il from Mr. Crawford*s account or 

2 Lee Paige, 1 don't recall. 

3 Q All right. Mow, we've looked at, 1 

4 think, three basic chains of e-mails, one 

5 involving Mr. Palmer, one involving Ms. Chase, one 

6 involving Ms. Latlimore. Are there any others 

7 thai you're aware of? 

8 A Well, involving which video clip? 

9 Any video clip of the accidental 

1 discharge. 

11 A Mo. I mean, involving MOS-MD video clip, 

12 the only chain I'm aware of is the one of Leon 

1 3 Palmer and Kimberiy Chase is the only one 

1 4 that's — and J would assume that Kimberiy Chase's 

15 e-mail is sort of in that family tree of the Leon 

1 6 Palmer one, it extended from something from that. 
17 Q But are you aware of any instances on 
1 Firebird where the video clip has been circulated 
19 regardless of ils source? 

2 MR.PHIPPS: Objection, vague. 

2 1 THE WITNESS: Prior to that dale or - 

22 BY MR. MEYTHALER: 
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